20410c11-150526161214-lva1-app6892.pptx
Post on 14-Dec-2015
213 Views
Preview:
TRANSCRIPT
Module Overview
Overview of Group Policy
Group Policy Processing• Implementing a Central Store for Administrative Templates
Lesson 1: Overview of Group Policy
Components of Group Policy
What Are Multiple Local GPOs?
Storage of Domain GPOs
What Are Group Policy Preferences?
What Are Starter GPOs?
Delegating Management of GPOs•Demonstration: Creating and Managing GPOs
Components of Group Policy
A Group Policy setting:• Defines a specific
configuration change• Can be applied to a user or
to a computer
A GPO:• Is a collection of Group
Policy settings• Can be applied to a user,
a computer, or both
What Are Multiple Local GPOs?
Multiple Local Group Policies:
There are three layers of user configurations:
User-specific
• Have a single computer configuration that applies to thecomputer for all users who log on
• Have layers of user settings that can apply only to individual users, not to groups
Non-Administrator
Administrator
Storage of Domain GPOs
Group Policy Components
GPO• Contains Group Policy settings• Stores content in two locations
Group Policy Container• Stored in AD DS• Provides version information
Group Policy Template• Stored in shared SYSVOL folder • Provides Group Policy settings
What Are Group Policy Preferences?
Use Group Policy preferences to:• Configure, deploy, and manage operating system and
application settings that are not manageable by using Group Policy
• Apply once at startup or sign in, optionally refresh at intervals
• Target to users or computers• Expand the range of configurable settings within a GPO
Group Policy preferences:• Are not enforced• Are not removed when the GPO no longer applies• Do not disable the interface of the setting; users can
changethe setting
• Cannot be used in local group polices
What Are Starter GPOs?
A starter GPO:• Has preconfigured administrative template
settings upon which new GPOs can be based• Can be exported to .cab files• Can be imported into other areas of the enterprise
.cab file
Exported to a .cab file
Imported toGPMC
Starter GPO Import to GPMC
Delegating Management of GPOs
Delegation of GPO-related tasks allows the administrative workload to be distributed across the enterprise
The following Group Policy tasks can be independently delegated:• Creating GPOs, including Starter GPOs• Editing GPOs• Managing Group Policy links for a site, domain, or OU• Performing Group Policy Modeling analysis in a domain or OU• Reading Group Policy Results data in a domain or OU• Creating WMI filters on a domain
Demonstration: Creating and Managing GPOs
In this demonstration, you will see how to:• Create a GPO by using the GPMC• Edit a GPO in the Group Policy Management Editor window• Use Windows PowerShell to create a GPO
Lesson 2: Group Policy Processing
GPO Links
Applying GPOs
Group Policy Processing Order
What Are the Default GPOs?
GPO Security Filtering
Discussion: Identifying Group Policy Application•Demonstration: Using Group Policy Diagnostic Tools
GPO Links
When linking GPOs, remember that:• To deliver settings to an object, a GPO must be linked to a container• Disabling a link removes the settings from the container• Deleting a link does not delete the GPO
GPOs can be linked to: GPOs cannot be linked to:
• Sites• Domains• OUs
• Users • Groups• Computers• System containers
Applying GPOs
When you apply GPOs, remember that:• Computer settings apply at startup• User settings apply at sign in• Polices refresh at regular, configurable intervals• Security settings refresh at least every 16 hours• Policies refresh manually by using:
• The Gpupdate command • The Windows PowerShell cmdlet Invoke-Gpupdate
• Since Windows Server 2012 and Windows 8, a new Remote Policy Refresh feature allows you to remotely refresh policies
Group Policy Processing Order
Group Policy Processing
OrderSite
Local GroupGPO1
GPO2
Domain
OU OU
OU
GPO3 GPO4
GPO5
What Are the Default GPOs?
There are two default GPOs:• Default Domain Policy
• Used to define the account policies for the domain:• Password• Account lockout • Kerberos protocol
• Default Domain Controllers Policy• Used to define auditing policies• Defines user rights on domain controllers
GPO Security Filtering
Apply Group Policy permissions• GPO has an ACL (Delegation tab, click Advanced)• Default: Authenticated Users have Allow Apply Group
Policy
Scope only to users in selected global or universal groups• Remove Authenticated Users• Add appropriate global or universal groups (GPOs do
not scope to domain local groups)
Scope to users except for those in selected groups• On the Delegation tab, click Advanced• Add appropriate global groups• Deny the Apply Group Policy permission
Discussion: Identifying Group Policy Application
Review the scenario and the AD DS structure graphic in the handbook to answer the following questions:
• What power options will the servers in the Servers OU receive?• What power options will the laptops in the Sales Laptops OU
receive?• What power options will all other computers in the domain
receive?• Will users in the Sales Users OU who have created local
policies to grant access to Control Panel be able to access Control Panel?• If you needed to grant access to Control Panel to
some users, how would you do it?• Can GPO2 be applied to other department OUs?
20 minutes
Demonstration: Using Group Policy Diagnostic Tools
In this demonstration, you will see how to:• Use Gpupdate to refresh Group Policy• Use the Gpresult command to output the results to an HTML file • Use the Group Policy Modeling Wizard to test the policy
Lesson 3: Implementing a Central Store for Administrative Templates
What Is the Central Store?
What Are Administrative Templates?
How Administrative Templates Work•Managed and Unmanaged Policy Settings
What Is the Central Store?
The Central Store:• Is a central repository for ADMX and ADML files• Is stored in SYSVOL• Must be created manually• Is detected automatically by Windows operating
systems
Windows workstation
Domain controller with Central Store
in SYSVOL
Domain controller gets
replicated copy of Central
Store
ADMX filesADMX files
What Are Administrative Templates?
.admx
.adml
Registry
Administrative Templates determine what settings appear and how they are grouped
in the GPO Editor
How Administrative Templates Work
• Changing policy settings in the Administrative Templates node also changes the registry
• Changing the Prevent access to registry editing tools setting changes the value of HKLM\Software\Classes\Regedit
Managed and Unmanaged Policy Settings
Managed policy settings:• UI is locked; user cannot make a change to the setting• Changes are made in one of four reserved registry keys• Change and UI locks are released when the user/computer falls out of scope
Unmanaged policy settings:• UI is not locked• Changes made are persistent: tattoos the registry• Only managed settings are shown by default• Set Filter options to view unmanaged settings
Lab: Implementing Group Policy
Exercise 1: Configuring a Central Store•Exercise 2: Creating GPOs
Logon Information
Virtual machines20410C‑LON‑DC120410C-LON-CL1
User name Adatum\AdministratorPassword Pa$$w0rd
Estimated Time: 40 minutes
Lab Scenario
A. Datum Corporation is a global engineering and manufacturing company with a head office based in London, England. An IT office and a data center are located in London to support the London location and other locations. A. Datum has recently deployed a Windows Server 2012 infrastructure with Windows 8 clients.
In your role as a member of the server support team, you help to deploy and configure new servers and services into the existing infrastructure based on the instructions given to you by your IT manager.
Your manager has asked you to create a Central Store for ADMX files to ensure that everyone can edit GPOs that have been created with customized ADMX files. You also need to create a starter GPO that includes Internet Explorer settings, and then configure a GPO that applies GPO settings for the Marketing department and the IT department.
Lab Review
What is the difference between ADMX and ADML files?
The Sales Managers group should be exempted from the desktop lockdown policy that is being applied to the entire Sales OU. All sales user accounts and sales groups reside in the Sales OU. How would you exempt the Sales Managers group?•What Windows command can you use to force the immediate refresh of all GPOs on a client computer?
top related